AI assistants (MCP)

Qlyne has an MCP server: an AI assistant can operate your sites with your account API key. Rules (the same document as rules as code), waiting room events, what is being blocked, IP lists, access gates, the scanner, sites and domains, and hosting by Qlyne. Billing, members and API keys stay out on purpose.

Connect

The server is at https://app.qlyne.com/mcp (HTTP transport). Authenticate with the account API key from Account › API key as a Bearer token.

Claude Code:

claude mcp add --transport http qlyne https://app.qlyne.com/mcp --header "Authorization: Bearer YOUR_API_KEY"

Cursor, Claude Desktop or any client that takes a JSON config:

{
  "mcpServers": {
    "qlyne": {
      "url": "https://app.qlyne.com/mcp",
      "headers": { "Authorization": "Bearer YOUR_API_KEY" }
    }
  }
}

A key generated before October 2026 also needs the header X-Tenant-ID with the id of one of your sites. Generating a new key in the panel removes that need.

Tools

Every tool takes the site id from list-sites.

Tool	What it does
list-sites	Your sites: id, name, plan, mode and domains
get-rules	The whole rules document of a site, as YAML
validate-rules	Checks a document without saving; every problem comes back with its path
apply-rules	Saves the document and tells the Qlyne servers; visitors see it within a minute
list-events	Waiting room events: key, open or closed, stage, release rate, capacity, times, live queue numbers
save-event	Creates an event or changes one: name, target URL, release rate, capacity, start and end, open or closed
release-visitors	Lets a number of people through an event right now
delete-event	Deletes an event and empties its queue
traffic-summary	Last 24 hours or 7 days: requests, passed, challenged, queued, blocked, each decision, spikes, top countries, paths, IPs, networks and user agents
recent-events	Recent requests the rules acted on, with the reason in words; filter by what happened, search any field
site-metrics	Live counters of the site (Prometheus text): decisions, queues, rate limits
ip-rules	The IP lists: list, block, trust, remove
access-gates	Password or e-mail link in front of paths: list, save, remove
run-scan	Starts the security scanner on the confirmed domain
scan-report	The latest finished scan: grade, findings with impact and fix, what was resolved
create-site	Adds a site to the account
set-domain	Sets the site domain and shows the TXT record that proves it is yours
check-domain	Looks the TXT record up and confirms the domain
hosted-proxy	Hosting by Qlyne: show, set origins with weights, hosts and options, or turn it off

The assistant reads before it writes, so it never guesses a field name. Ask it in plain words:

Put loja in enforce mode and block Tor, but keep the waiting room as it is.

Open a waiting room for the drop on Friday at 8 pm, 200 people a minute, and send /drop to it.

Who was blocked in the last hour, and why?

apply-rules and delete-event are marked destructive in the protocol, so well-behaved clients confirm them with you.

Limits

120 calls a minute per account. The document has to be sent whole, not in parts, and up to 256 KB.